|Publication number||US4472806 A|
|Application number||US 06/373,952|
|Publication date||Sep 18, 1984|
|Filing date||May 3, 1982|
|Priority date||May 3, 1982|
|Publication number||06373952, 373952, US 4472806 A, US 4472806A, US-A-4472806, US4472806 A, US4472806A|
|Inventors||John D. Blair|
|Original Assignee||The Boeing Company|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (16), Referenced by (21), Classifications (12), Legal Events (5)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The present invention pertains to the signal processing art and, more particularly, to an improved apparatus for, and a method of redundant signal selection and fault detection and isolation.
Numerous redundant signal selection systems, which include fault detection and isolation, are known to the prior art. A particular application for such systems is in the aviation art, wherein several sensors, each sensing the same aircraft parameter, provide output data signals. Processing circuitry receives the data signals, and, in accordance with predetermined logic, selects that data signal, or combination of signals which is most likely to be representative of the acutual aircraft parameter. The output from the signal selection system is then used in aircraft control circuitry, such as the autopilot or autothrottle system.
Signal selection systems commonly employ fault detection and isolation circuitry. Such circuitry monitors the imput data signals and, in accordance with a fault detection algorithm, identifies and isolates that input data signal which exhibits a fault characteristic. To further enhance the ability of the fault detection system to isolate failures, it is known to provide equalization to all of the input data signals, thereby eliminating fixed offset errors existing between channels.
U.S. Pat. No. 4,276,648 describes one such signal selection and fault detection system. Here, multiple redundant sensor signals are processed through an equalizing and selecting network which outputs the midvalue signal and eliminates all null offsets occurring among signals. Faults of both low and high frequency are detected, resulting in the isolation of the appropriate signal channel.
Where triple redundant sensors are used, the above described prior art signal selection apparatus operates fail-passive after a second detected failure. That is, upon the failure of two of three signal channels, this system causes its output to be driven smoothly to zero, regardless of the signal produced by the remaining good channel.
In certain applications, it is preferable to remain operational after two or three failures. Thus, a system which is capable of positive fault identification of two of three channels, while continuing operation with the remaining good third channel, would fulfill a need in the signal processing art.
It is an object of this invention, therefore, to provide apparatus for, and a method of providing signal selector apparatus which includes fault detection and isolation circuitry capable of positively identifying and isolating each failed channel.
It is a further object of the invention to provide the above-described apparatus and method in a system which is fail operational following the failure of all but one channel.
Briefly, according to the invention, apparatus for selecting one of several input signals includes a plurality of equalizer channels with each equalizer channel processing one of the input signals and compensating the signal with respect to a midvalue selected signal. A midvalue selector, having a plurality of inputs and and output, with each input being coupled to one of the equalizer channels, produces at its output the midvalue one of the compensated input signals. Fault detector circuitry identifies as a fault each compensated input signal which deviates from the midvalue selected signal by a predetermined value. Once a fault is identified, the errant signal is isolated from the midvalue selector input and, substituted therefor, is the output signal from the midvalue selector.
The fault detector also includes a means for identifying the isolation of all identified compensated input signals save one from the inputs to the midvalue selector and, in response thereto, directly coupling the remaining compensated signal as the output from the signal selector apparatus.
The method for selecting one of several input signals comprises the first step of equalizing each input signal with respect to a midvalue selected signal and thereby producing a plurality of compensated input signals. Next, the midvalue one of the plurality of compensated input signals is midvalue selected. Each compensated input signal which deviates from the midvalue selected signal by a predetermined value is identified as a fault. Each fault identified compensated input signal is isolated from the midvalue selecting process and, substituted in its place, is the midvalue selected signal.
Further, the method includes identifying the condition of the isolation of all compensated input signals save one and providing the remaining compensated input signal as the selected output signal.
The single FIGURE illustrates in block diagram form the preferred construction of the improved signal selection and fault detection and isolation system according to the invention.
The FIGURE illustrates the preferred embodiment of the invention, adapted for triple redundant input sensors. Here, input data signals from each of three redundant sensors 11, 12 and 13 are passed through switching circuits 14, 15 and 16, respectively, to the inputs of three equalizing channels 21-23.
Inasmuch as the three equalizing channels 21-23 are identical, the discussion herein is limited to the first channel 21. The data signal from sensor 11 is passed to the input of a first summer circuit 31. Also coupled to an input of summer circuit 31 is a feedback signal which, as will be understood more thoroughly given the discussion hereinbelow, compensates the input signal with respect to a selected midvalue signal.
The selected midvalue signal is added, in the negative sense, to the compensated input signal at a second summer 32. The resultant signal from summer 32 is passed through a rate limiter 33 which, in the normal manner, limits the rate of change of an input signal to a given value. The output from limiter 33 is multiplied by a gain factor K and integrated in an integrator 34. Integrator 34 is initialized via initialize circuitry 35 to an initial value, such as zero, on system startup and upon failure of the channel.
The output from integrator 34 is the feedback signal which is applied to the summer 31. The feedback loop including the limiter 33 and the integrator 34 to the combiner 31 generates an error signal which, when added to the input signal, compensates the input signal with respect to the midvalue selected signal. In this manner, fixed offset biases, such as may be produced by offsets within sensors 11-13 are fully equalized. The use of limiter 33 permits the use of a relatively large gain K thereby increasing loop gain and ensuring good tracking while minimizing the effects of transient disturbances.
The compensated input signals which are produced at the outputs of the equalizing channels 21-23 are coupled through switches 41-43, respectively, to inputs of a midvalue selector 44. Midvalue selector 44 operates in the conventional manner to produce at its output that input signal which has a value between the remaining input signals.
The selected midvalue signal is passed through a switch 45 as the selected output of the signal selection system.
Fault detection is performed by monitoring the magnitude of the signals generated in each equalizer loop. Since the detection circuitry is identical for each loop, it will only be discussed with reference to the first channel 21.
The signal out of integrator 34 represents the steady-state difference between each input signal and the selected midvalue signal. The steady-state difference signal is passed to a threshold detector 51 which, in the conventional manner, produces a high-level output signal in response to the input difference signal exceeding a predetermined threshold level. The output from threshold detector 51 is applied as one input to an OR gate 52.
The signal out of the second combiner 32 represents the instantaneous difference between the input signal and the midvalue selected signal. The output from summer 32 is applied at an input of a threshold detector 53.
Threshold detector 53, in a manner similar to detector 51, produces a high-level output signal in response to the instantaneous difference signal exceeding a predetermined threshold. This high output signal is passed both to the input of a timer 54 and as one input to an AND gate 55. Also connected to an input of AND gate 55 is the output from a valid discrete circuit 56. Various sensors, such as sensor 11, may be provided with internal circuitry for determining whether or not the sensor has failed. This internal circuitry, such as valid discrete 56, produces a high-level output signal in response to a detected sensor failure. Thus, AND gate 55 is satisfied when both its valid discrete 56 and the threshold detector 53 indicate a failure. In this event, AND gate 55 applies a high-level output signal to an input of OR gate 52.
The final input to OR gate 52 is the output from the timer 54. Timer 54 produces a high output level in the event that the output from the threshold detector 53 indicates the existence of a fault condition for a sufficient period of time. Thus, a transient fault will not be of sufficient duration to cause timer 54 to produce a high-level output.
Upon receiving a high-level signal at any of its inputs, OR gate 52 produces a high-level output signal which is passed to an input of OR gate 59. The output from OR gate 59 is applied to one input of an AND gate 57, whose remaining input receives a reset input. The output from AND gate 57 is the remaining input to OR gate 59.
In operation, a steady-state error as sensed by threshold detector 51, or an instantaneous error a sensed by threshold detector 53, which persists for a period of time determined by timer 54, or the combination of an instantaneous failure and a valid discrete indicated failure causes the output from OR gate 52 to go high and thus the output from OR gate 59 to go high. In this case, a high level at the output of OR gate 59 indicates a failure in the first equalizing channel 21. This failure would likely result from some form of failure of sensor 11.
In response to such a failure being identified, the high-level failure signal is used to activate its corresponding switch 14-16 to its alternate position. Thus, a high level out of OR gate 59, indicating a failure in channel 21, causes switch 14 to be activated to its alternate position. As seen, in its alternate position each of the switches 14-16 isolates its corresponding sensor 11-13 from the system, and in turn feeds as an input signal to its equalizer loop the midvalue selected output signal. In so doing, the median selection process continues among three signals, thereby assuring a positive subsequent failure identification.
It will be noted that the effect of substituting the midvalue selected signal out of midvalue selector 44 for the sensor signal out of one of sensors 11-13 will be for the corresponding equalizing channel 21-23 to output the midvalue selected signal. Assume, for example, that a failure causes switch 14 to switch the midvalue selector 44 produced signal to the input of summer circuit 31. Now, since summer 32 has the midvalue selected signal at both of its inputs, its output will be zero and, through limiter 33 and integrator 34, the negative input to summer circuit 31 will be zero. Thus, the midvalue selected signal wil be added to zero in summer 31 and applied to one of the inputs of midvalue selector 44. The operation of the fault detection circuitry is, therefore, to isolate a fault detected, equalized input signal from the input of the midvalue selector and substitute in its place the midvalue selector output signal.
If a second failure is identified and, thus, the compensated input signal from the failed channel isolated from the midvalue selector, an appropriate one of the switches 41-43 is activated to its alternate position. If, for example, failures have been identified, and signals isolated in channels 22 and 23, switch 41 is activated to its alternate position. Also, in response to the failure of any two channels, switch 45 activates to its alternate position, causing that compensated input which survives as the only valid signal to be routed directly as the system's selected output.
For systems wherein more than three redundant input signals are provided, the present system would be modified such that upon failure of all channels save one, the remaining valid signal would be switched directly as the selected output.
Thus, the present system is fully operational after the failure of all but one of the processing channels.
In summary, apparatus for, and a method of improved redundant signal selection and fault detection and isolation has been shown.
While a preferred embodiment of the invention has been described in detail, it should be apparent that many modifications and variations thereto are possible, all of this fall within the true spirit and scope of the invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US3054039 *||Sep 5, 1958||Sep 11, 1962||Lello Meredith Dennis||Plural channel servo systems|
|US3145330 *||Nov 16, 1962||Aug 18, 1964||Sperry Rand Corp||Servomechanism apparatus|
|US3190586 *||Jul 13, 1962||Jun 22, 1965||Smith & Sons Ltd S||Automatic control systems|
|US3334282 *||Sep 30, 1963||Aug 1, 1967||Honeywell Inc||Plural channel control apparatus|
|US3469162 *||Apr 1, 1966||Sep 23, 1969||Hawker Siddeley Dynamics Ltd||Multiplex-type control apparatus|
|US3496836 *||Jan 2, 1968||Feb 24, 1970||Bell Aerospace Corp||Redundant control system having fail-operate fail-neutral and channel emergency select|
|US3551776 *||Oct 1, 1968||Dec 29, 1970||Bendix Corp||Triple redundant servo flight control including digital resynchronization of channels,detection of failed channels,and voted output|
|US3573587 *||Sep 16, 1969||Apr 6, 1971||Smiths Industries Ltd||Multiplex systems|
|US3686493 *||Nov 13, 1970||Aug 22, 1972||Gen Electric||Limited average voter circuitry|
|US3805235 *||Dec 26, 1972||Apr 16, 1974||Collins Radio Co||Equalization means for multi-channel redundant control system|
|US3979720 *||Apr 30, 1975||Sep 7, 1976||Siemens Aktiengesellschaft||Apparatus for monitoring a redundant multi-channel analog system|
|US4101958 *||Sep 1, 1977||Jul 18, 1978||Rockwell International Corporation||Apparatus and method for effecting redundant control data transfer in a digital flight control system|
|US4105900 *||Feb 16, 1977||Aug 8, 1978||The Boeing Company||Signal selection apparatus for redundant signal sources|
|US4276648 *||Sep 4, 1979||Jun 30, 1981||The Boeing Company||Midvalue signal selection and fault detection apparatus and method|
|GB1334531A *||Title not available|
|SU396011A1 *||Title not available|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US4594714 *||May 2, 1983||Jun 10, 1986||United Technologies Corporation||Dual-actuator monitor|
|US4599698 *||May 2, 1983||Jul 8, 1986||United Technologies Corporation||Aircraft trim actuator shutdown monitor system and method|
|US4667284 *||May 5, 1984||May 19, 1987||Hitachi, Ltd.||Multiplexing control unit|
|US4761748 *||Sep 13, 1985||Aug 2, 1988||Framatome & Cie||Method for validating the value of a parameter|
|US4772445 *||Dec 23, 1985||Sep 20, 1988||Electric Power Research Institute||System for determining DC drift and noise level using parity-space validation|
|US5200691 *||Mar 18, 1991||Apr 6, 1993||Kabushiki Kaisha Toshiba||Control system for excitation of synchronous machine|
|US5202679 *||Apr 1, 1991||Apr 13, 1993||United Technologies Corporation||Mid-value signal selection system|
|US5428769 *||Mar 31, 1992||Jun 27, 1995||The Dow Chemical Company||Process control interface system having triply redundant remote field units|
|US5469447 *||Oct 28, 1994||Nov 21, 1995||General Electric Company||Apparatus for selecting a valid signal from a plurality of redundant measured and modelled sensor signals|
|US5661735 *||Dec 26, 1995||Aug 26, 1997||Litef Gmbh||FDIC method for minimizing measuring failures in a measuring system comprising redundant sensors|
|US5747950 *||Nov 30, 1993||May 5, 1998||Danfoss A/S||Steering system for vehicles or ships|
|US5862315 *||May 12, 1997||Jan 19, 1999||The Dow Chemical Company||Process control interface system having triply redundant remote field units|
|US5970226 *||Jan 26, 1995||Oct 19, 1999||The Dow Chemical Company||Method of non-intrusive testing for a process control interface system having triply redundant remote field units|
|US6061809 *||Dec 19, 1996||May 9, 2000||The Dow Chemical Company||Process control interface system having triply redundant remote field units|
|US9092313||Jan 25, 2013||Jul 28, 2015||Honeywell International Inc.||System and method for three input voting|
|US9151786 *||Oct 11, 2010||Oct 6, 2015||General Electric Company||Systems, methods, and apparatus for detecting shifts in redundant sensor signals|
|US20080306647 *||Jan 30, 2008||Dec 11, 2008||Jae Wook Jeon||In-vehicle network system and control method thereof|
|US20130253859 *||Mar 23, 2012||Sep 26, 2013||Robert Erik Freeman||Systems and methods for signal selection and fault detection|
|US20130293217 *||Oct 11, 2010||Nov 7, 2013||General Electric Company||Systems, methods, and apparatus for detecting shifts in redundant sensor signals|
|EP0315227A2 *||Sep 6, 1988||May 10, 1989||The Boeing Company||Dual channel signal selection and fault detection system|
|EP0446954A2 *||Mar 15, 1991||Sep 18, 1991||Kabushiki Kaisha Toshiba||Control system for excitation of synchronous machine|
|U.S. Classification||714/820, 318/564, 714/E11.069|
|International Classification||G05B9/03, G06F11/18|
|Cooperative Classification||G06F11/18, G06F11/188, G06F11/181, G05B9/03|
|European Classification||G05B9/03, G06F11/18, G06F11/18V4|
|May 3, 1982||AS||Assignment|
Owner name: BOEING COMPANY THE, SEATTLE, WA A CORP. OF DE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST.;ASSIGNOR:BLAIR, JOHN D.;REEL/FRAME:003980/0380
Effective date: 19820427
|Apr 27, 1988||SULP||Surcharge for late payment|
|Apr 27, 1988||FPAY||Fee payment|
Year of fee payment: 4
|Dec 13, 1991||FPAY||Fee payment|
Year of fee payment: 8
|Dec 11, 1995||FPAY||Fee payment|
Year of fee payment: 12